HPE Aruba Private 5G Core Vulnerability Exposes Admin Credentials via Phishing-Style Attack A critical vulnerability in HPE Aruba Networking’s Private 5G Core On-Prem platform, tracked as CVE-2026-23818, has been disclosed, enabling attackers to steal administrative credentials through a sophisticated phishing-style exploit. The flaw, detailed in HPE security bulletin HPESBNW05032EN_US, affects the platform’s graphical user interface (GUI) and stems from an open redirect vulnerability in the login workflow. The issue arises from inadequate sanitization of redirect parameters, allowing threat actors to manipulate post-authentication navigation. Attackers exploit this by crafting malicious URLs that appear legitimate, tricking users typically network administrators into clicking them. Upon interaction, the victim is redirected to an attacker-controlled server hosting a fake login page designed to mimic the authentic Aruba interface. Unsuspecting users re-enter their credentials, which are then captured before being seamlessly redirected back to the real login page, making the attack difficult to detect. The impact of CVE-2026-23818 is severe for enterprises relying on private 5G infrastructure. Compromised credentials could grant attackers unauthorized access to network configurations, enable interception or manipulation of sensitive communications, disrupt services, or facilitate lateral movement within corporate environments. Since the attack relies on social engineering rather than malware, traditional endpoint security tools may fail to detect it. HPE has released patches to address the vulnerability, urging organizations to update affected systems immediately. The flaw underscores the growing threat to user-facing interfaces in private 5G deployments, where attackers increasingly target authentication workflows to bypass security controls.

Aruba Central network monitoring platforms suffered from a data breach incident that allowed a threat actor to access collected data about monitored devices and their locations. The exposed information contained two datasets, one for network analytics and the other for Aruba Central's 'Contract Tracing' feature. "One dataset ("network analytics") includes network telemetry information about Wi-Fi client devices connected to customer Wi-Fi networks for the majority of Aruba Central customers. Another dataset called "contact tracing" comprised location-specific information on Wi-Fi client devices, such as which devices were close to other Wi-Fi client devices. The compromised information includes MAC addresses, IP addresses, device operating system type and hostname, and some usernames. The contact tracing data also included users’ Access Point (AP) name, proximity, and duration of time connected to that AP. They said it's not necessary to change passwords, change encryption keys, or modify your network setup because security-sensitive data was not compromised. In order to stop reoccurring problems, HPE said they are modifying how they safeguard and keep access keys.